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Every security analysis of quantum key distribution (QKD) relies on a faithful modeling of the 
employed quantum states. Many photon sources, like for instance a parametric down conversion 
(PDC) source, require a multi-mode description, but are usually only considered in a single-mode 
representation. In general, the important claim in decoy-based QKD protocols for indistinguisha- 
bility between signal and decoy states does not hold for all sources. We derive new bounds on the 
single photon transmission probability and error rate for multi-mode states, and apply these bounds 
to the output state of a PDC source. We observe two opposing effects on the secure key rate. 
First, the multi-mode structure of the state gives rise to a new attack that decreases the key rate. 
Second, more contributing modes change the photon number distribution from a thermal towards 
a Poissonian distribution, which increases the key rate. 



I. INTRODUCTION 

The security of classical cryptography is based on the 
high computational complexity of the decryption process 
combined with the condition that the adversary only has 
a limited amount of computational power. In contrast, 
quantum key distribution (QKD) allows two parties, Al- 
ice and Bob, to share a secret key that is inaccessible to 
an eavesdropper Eve whose power is only limited by the 
laws of quantum physics. In 1984, Bennett and Brassard 
introduced the first QKD protocol BB84 [1 . It is still 
the most commonly used protocol, although many more 
have been proposed since then [21 EH]. 

This first theoretical proposal assumed perfect devices, 
namely single-photon sources and error-free transmission 
and detection. With the development of sophisticated se- 
curity proofs, these restrictions could gradually be less- 
ened. First, security has been proved in the presence of 
noise [5J |B]. In the next step, the necessity of single- 
photon sources has been taken out of the equation [7]. 
This, however, reduced the achievable key rate drasti- 
cally, because multiphoton events give rise to the photon 
number splitting (PNS) attack EH], which Alice and 
Bob cannot distinguish from natural losses. 

This issue can be resolved with the decoy method, 
which was introduced by Hwang [11] , and has been fur- 
ther developed to a practically realizable form by several 
researchers [T2j [13j [14] . In this method, additional decoy 
states with a different photon number distribution than 
the primary signal states are randomly introduced. It is 
crucial that decoy states share all other physical char- 
acteristics of the signal so that Eve cannot distinguish 
between decoy and signal. Consequently, the decoys are 
affected by the PNS attack in the same way as the sig- 
nal states, and this perturbation of the system reveals 
Eve's presence. Since Eve has to design her attack in 
a way that cannot be detected by Alice and Bob (oth- 
erwise the protocol is aborted), her attack possibilities 
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are drastically limited when she is confronted with a de- 
coy protocol. This enables Alice and Bob to achieve an 
improved key rate. 

The important assumption that Eve cannot distinguish 
between photons arising from signal and decoy states is 
trivially fulfilled for a single-mode description where all 
photons are created by the same creation operator. How- 
ever, this model does not match experimental reality well. 
Hence, in this paper, we treat the scenario where photons 
are excited into many different modes and the excitation 
probability for each mode differs between signal and de- 
coy states. This multi-mode description is, for instance, 
necessary for a realistic representation of the states cre- 
ated by a parametric down conversion (PDC) source, in 
which case the different modes correspond to different 
spectral modes [15]. 

This paper is organized as follows. In Sec. [II] we re- 
view the decoy method and introduce the notation nec- 
essary for the subsequent analysis. Sec. |III| presents the 
description of a multi-mode state with special emphasis 
on spectral modes for the description of a PDC state. 
In Sec. |IV| and [Vj we describe new attack possibilities 
when multi-mode states are used and derive new bounds 
that allow us to calculate the achievable key rate in this 



scenario. Sec. VI finally applies the analysis to the multi- 
mode PDC state and gives new bounds on the achievable 
key rate. 



II. DECOY METHOD 

The security of BB84 is based on the no-cloning the- 
orem [16] , which prevents Eve from making a copy of a 
transmitted single photon. However, the security argu- 
ment is not applicable to multiphoton events, because for 
these events Alice implicitly encodes the same informa- 
tion on all photons in the pulse. This, in turn, allows Eve 
to obtain an identical copy of Bob's state by splitting 
away one of the photons. Hence only detection events 
arising from single photons give a positive contribution 
to the secure key rate. With current technology, Alice is 
not able to determine the number of photons her source 
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emitted. Thus Alice and Bob cannot simply ignore mul- 
tiphoton events. In this scenario, a lower bound on the 
secure key rate S is given by [7J 
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Here pi (ft € N ) denotes the photon number distri- 
bution of Alice's source, f(E^) is the error correction 
efficiency, H(x) = — x\og(x) — (1 — x)\og(l — x) is the 
binary Shannon entropy and q accounts for incompatible 
basis choices of Alice and Bob. In the standard BB84 
protocol, q — 1/2. The overall detection probability is 
given by the gain 



Q {s) = 



where the yields Yq , Y^ and Y^' are the detector click 
probabilities conditioned on emitted zero-, one-, and mul- 
tiphoton events of Alice's source, respectively. Analo- 
gously, the zero-, one- and multi-photon error rates, eo, 
ei and eyi, are defined as the error rates conditioned on 
emitted zero-, one-, and multiphoton events, respectively 
The relation to the total quantum bit error rate (QBER) 
is given by 

Q^E^ = e Y oP W + e^YlVf + e&'ltfM?- (3) 

The QBER and the gain Q( s > are directly accessible from 
the recorded data of the QKD protocol. However, since 
Alice and Bob do not know when a single photon was 

(s) 

sent, they cannot determine the exact values of Y± and 

(s) 

e\ , but need to estimate them using worst-case assump- 
tions. Prior to the decoy method, they had to assume 
that all multiphoton events produce a click at Bob's de- 

(s) 

tector. This corresponds to YJjj = 1, and a lower bound 

on can be calculated with Equation pi. This esti- 
mate, however, lies well below the single photon trans- 
mission probability caused by natural losses. In addition, 
Alice and Bob have to assume that all errors arise from 

single photon events, resulting in a very high estimate of 

(si 

e\ . These values are actually achieved if Eve performs 
a photon number splitting (PNS) attack J5J O HO], and 
lead to a drastically reduced key rate [7J . 

The decoy method enables Alice and Bob to attain 

(s) (s) 

better estimates of Yf ' and . This is achieved by 
randomly introducing "decoy" states with independent 
photon number distributions. For each photon number 
distribution, the gain and QBER can be determined in- 

(s) (s) 

dividually, resulting in better bounds on Y{; ' and ' . 

In this paper, we base our analysis on the so-called 
vacuum+weak decoy method [T3] , which uses two de- 
coy states. Deliberately interspersing the signal stream 
with vacuum states (p n — S n o, gain Q — Yq) allows Al- 
ice and Bob to determine the dark count probability Yo. 
The second decoy state is of low intensity and features 
a photon number distribution P n that differs from the 
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photon number distribution p n of the regular signal. In 
the following, we will refer to this state as the decoy state, 
and to the state with photon number distribution p n as 
the signal state. The gain for the decoy state is given by 



} (d) = y p ( o d) 
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with the yields defined equivalently to the signal yields. 
The yield Yq for an emitted zero-photon state has to be 
the same for all states because Eve cannot distinguish 
between vacua arising from different states. However, 
there is no a priori reason for the single- and multiphoton 
yields to be the same for signal and decoy. In the analyses 
up to now, it was assumed that Eve cannot distinguish 
between n-photon events arising from signal and decoy 
( 2 ) state, resulting in y„ (s) = F„ (d) (n <E N ). Note that 



this is the assumption we will loosen in Section |IV[ as it 
is generally not justified in a multi-mode description of 

the states. However, proceeding with Y^ = Yn , from 
Equations Q and Q the lower bound 
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on the signal single photon yield can be derived if the 
additional condition 
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is satisfied. This is, for instance, fulfilled if both signal 
and decoy have a Poissonian or thermal distribution with 
a lower mean photon number for the decoy distribution. 

With a similar Equation to ([3| for the decoy QBER 
(i.e., (.)( s ) — > (O^); an upper bound on the single photon 
error rate of the decoy state can be calculated as 
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The postulated indistinguishability of n-photon states for 
signal and decoy gives e[ s ^ b 
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1/2, since a dark count 



gives the wrong result 50% of the time. 

The derived bounds, Equations ([5| and Q, are much 
tighter than the worst case assumptions without decoy 
states. Therefore using them in Equation ([T]) results in a 
significant improvement in the achievable secure key rate 

m. 



III. THE MULTI-MODE STATE 

QKD analyses generally assume that Alice's output 
states are accurately represented by a single-mode de- 
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scription as 
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where p( s / d ) (n) denotes the signal and decoy photon num- 
ber distributions. 

This form intrinsically implies that all emitted pho- 
tons have identical properties, in particular they are all 
excited into the same spectral mode. This appears as an 
appropriate modeling for weak coherent pulses emitted 
by a laser as multi-mode effects can be expected to be less 
critical. However, designing a PDC source with single- 
mode emission is a complex task, as it requires two out- 
put beams with independent spatio-spectral mode struc- 
tures [TT] . 

A type-11 PDC process emits photons in two different 
polarization modes, called signal and idler. The pho- 
ton numbers in signal and idler modes are strictly corre- 
lated. If PDC sources are used in "prepare and mea- 
sure" QKD protocols, only the photons of the signal 
mode are employed for information encoding. Describ- 
ing the PDC output state in a single-mode description 
as |\I/( s / d )) = J2 n c^ s / d ^(n) |n) s \n)j, we can obtain signal 
states of the form of Equation (pi) by tracing over the 
idler mode. 

A more realistic model of the PDC output state has to 
account for the multi-mode structure as follows [15] : 

JV 



different intensities, the mode distributions for signal 
and decoy states will be different and our multi-mode 
treatment becomes essential. 

In our numerical simulations, Section |Vf[ we will re- 
turn to investigating the PDC state to illustrate the 
multi-mode effects in decoy-based QKD systems. Note, 
however, that the following analysis applies to all states 



of the form ( 12 1 and is by no means restricted to a PDC 



source or spectral modes. 



IV. NEW BOUND ON Y{ 



Recall that in a single mode description, the yields for 
n-photon signal and decoy states are identical and thus 
a lower bound on Yy can be computed by Equation ^ 
from the known gains and photon number distributions. 

In this section, we develop a means of computing a 

(s) 

lower bound on Y± for multi-mode states as defined in 



Equation (TL2l) . For states of this type, Y„ — Yn is no 



longer valid for n > 1. Note, however, that Yq is still the 
same for signal and decoys, because for zero emitted pho- 
tons the resulting state is always described by the same 
vacuum state and thus Eve cannot treat these pulses dif- 
ferently for signal and decoys. The derivation of the new 

(s) 

lower bound on Y^ proceeds in three steps. First, we 
derive a lower bound on the signal single-photon yield 
Y^ for a given decoy single-photon yield Y^ d \ Then, 



|v]/( s / d )^ = (S?) c^^^fc n) In In (9) we determine an upper bound on the decoy multiphoton 
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yield Y^ 1 for a given signal multiphoton yield . Fi 
nally, with these two relations, we are able to calculate 
a lower bound on Y-jf for given signal and decoy gains, 
and Q^. 

Step 1 - Lower bound on Y} s) for a given 

Assume Eve has to let a certain fraction of the decoy 
single-photon events pass to achieve the desired decoy 
gain. In this step, we are seeking the lowest possible value 

(s) 

for the signal single-photon yield Y± that is compatible 



with 
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Equation (10 1 describes a state with n photons in the 



spectral mode £fc(w). Here £fc(w) is a set of orthonor- 
mal functions, therefore the orthonormality condition 
(n, £i\m, £j) = 8 nm 5ij holds. For a detailed description 
of this notation, see [TS]. Note that we consider only one 
spatial mode in Equation (|9j, which can be achieved by 
using a single mode fiber. The following analysis, how- 
ever, does not depend on the mode type and thus can also 
be applied to states with more than one spatial mode. 
Tracing out the idler mode gives the state 



with the given Y^\ Using Equation (pj), we find the 
conditioned one-photon state to be 
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where we define the mode occupation probabilities by 
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(fc,n)| : 



sech 2 d ^ tanh 2n r^ d ^ in the signal arm [15] . Here the 

squeezing parameter r^ d ^ oc %/ /( s / d ) is proportional to 
the square root of the pump intensity. Hence, if signal 
and decoy states are created by pumping the crystal with 



and the single-photon probability is given by 

Pl s/d) = £? (8/d) (M) IIp (B/d) M)' ( 15 ) 

k ijtk 

We have to assume that Alice does not have the technol- 
ogy to determine in which mode a photon resides. Re- 
member that she cannot even determine the total number 
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FIG. 1: (Color online) Eve blocks all photons in the second 
mode. This results in different single-photon yields for signal 
and decoy state. 



of emitted photons for a given event. However, an appa- 
ratus that measures the number of photons in each mode 
individually is possible in principle, because all modes 
are orthogonal. Therefore, if we want to claim uncon- 
ditional security, we have to give Eve knowledge about 
how many photons each mode contains. For the single- 
photon case, this means that she knows in which mode 
the photon is. This, in turn, allows Eve to reach different 
single-photon yields for signals and decoys by selectively 
blocking modes if the mode occupation probabilities nik 
differ for signal and decoy state. 

Figure [T] illustrates how this can be accomplished for 
the case of two different modes with —0.7, = 
0.3, rr4 s) = 0.6 and m { 2 s) = 0.4. If Eve blocks all pho- 
tons in the second mode, 70% of the decoy single-photons 
event are transmitted, but only 60% of the signal single- 
photons pass through the channel. This results in the 



yields Y/ s) = 0.6 and Y^' = 0.7. 

For a given decoy single-photon yield Y^ J , we denote 
the smallest possible value Eve can achieve for Y± as 



(d) _ 
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^i it> (m )• In our example above, we have Yfl = 6/7 • 
Y± for Y^ < 0.7, because in this case the photons of 

the first mode are sufficient to reach . Thus Eve can 
completely block the second mode and let only photons 
of the first mode pass. For yS A ' > 0.7, Eve additionally 
has to let a fraction (Y^ — 0.7)/0.3 of the photons in 
the second mode pass to reach Y x , resulting in Y^ h = 

0.6 + (Yi (d) - 0.7) /0.3 • 0.4. 

This concept is easily extended to all N modes that 
contribute to the state of Equation ( fl3| . Without loss 
of generality, we take m^/m^ > / mi > ■■■ > 
mff /wjjy . Only letting photons from the first mode pass 
results in the smallest ratio between Y^ and Y± , but 

this is only possible if Y^ < m\ . Otherwise, addi- 
tional photons from other modes are needed to achieve 
the desired Yj . The number K of required modes is 
implicitly defined by 
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such that both inequalities hold. Eve can achieve 
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the lowest possible value for Yf by letting all pho- 
tons of the first K — 1 modes, and a fraction 



Y 
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l x — J2k=i m fc Qj J l m ^K °f the P u °t° ns m the Kth 
mode pass. This gives the desired value for the decoy 
single-photon yield 
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and the lower bound 
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for the signal single-photon yield for a given Y^ 

Step 2 - Upper bound on Yjjp for a given Y^y: 
In this step, we want to find the highest possible decoy 
multiphoton yield that is compatible with a given signal 
multiphoton yield. With minor modifications, this works 
out analogously to step 1, the only difference being that 
we have to keep track of all possible distributions of the 
photons among the modes. For this purpose, we intro- 
duce the set Q = {I G N^| J2k=i l k > 2}- Each member 
of this set represents a multiphoton event with Zj photons 
in the ith mode. 

Similarly to nik for the single-photon case, we define 
hi as the probability that a multiphoton event possesses 
the photon distribution specified by 1 G Q. It is given by 
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with the multiphoton probability 
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n>2 



p(s/d) 



denotes the convoluted photon number 



Accordingly, P { 
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where 

distribution of all modes. 
rifeLiP (s/d) (M) and P 1 (s/d) is given by Equation (pi 



Employing the mode distribution probabilities of Equa- 



tion (19), the states of Equation (12 1 conditioned on a 



multiphoton event can be written as 
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Again, Eve is not only allowed to make a photon num- 
ber measurement but can also determine the mode dis- 
tribution 1 of a multiphoton event. Thus she can selec- 
tively block multiphoton events with certain mode dis- 



tributions. The highest possible Yj^ d ' for a given Y^' is 
(16) achieved if Eve lets only events with the highest ratio 
between h[ d ^ and pass. To sort the mode distribu- 
tions accordingly, we define L\ 
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argmax LeQ h> L >/h[ 
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and recursively 



2. Next, use UB t° derive an upper bound on 
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with Equation (24) 
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With that definition, we can apply the same method as 
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in step 1. For a given K 
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we define X implicitly by 

(23) 



■ ib (<ub) (28) 
3. Obtain a lower bound on Y^ d ' from 5^ UB with 
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Equation (26 1 
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Kr , is achieved if all multiphoton events with mode 
distributions L\ to Lk-x, and the remaining fraction 

( Yffi — EiLi* h%l J /hi, K with mode distribution Lk Y^^b, using Equation ( 18 1 

are transmitted to Bob's side, 
upper bound 
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4. Finally, determine a lower bound on Y± from 



As a result we have the 
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on the decoy multiphoton yield YSjp for a given signal 
multiphoton yield Y 1 
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Step 3 - The new bound on for given gains 

and Q^: With the derived relations between the 
yields of signal and idler events, we are now able to calcu- 

(s) 

late a new lower bound on Y-£ for given signal and decoy 
gains. If the relations were just given by a constant ratio, 
this would be in direct analogy to the single-mode case 
where the ratio of signal and decoy yields was fixed. This 
means we could plug the relations into Equation Q and 
solve Equations Q and Q for a lower bound on Y^ 



However, the derived relations, Equations (18 1 and (24 1, 



do not have a simple functional form. Hence an iterative 
approach is required to determine the new lower bound 



on Y-, 



We first solve Equations (J2) and @ for Y^ s) and y/ d) , 
respectively: 



Y. 



(s) 



M 



P 



(s) 



)00 



P n (s) Yo - P, w y 



(s) v ( s ) 



(d) 



Pi 



(d) 



(d) 



p(d) v 



p(d) v (d) 



(25) 
(26) 



Alice and Bob know Yq from the vacuum decoy state. 
They can measure and , and they know Po, Pi 
and Pm for both signal and decoy because they know 
the properties of their source. In addition, a trivial lower 



bound on Y^ is given by Y 1 W > Y 1 
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with that value, a tighter bound can be calculated by 
the following algorithm: 

(s) 

1. Start by calculating an upper bound on FA from 
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Y± lb ' usm g Equation ( 25 ) 
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The value obtained in Equation (30) can iteratively be 



plugged into the previously described steps as initial 
value, which results in an even tighter bound. After each 

(s) 

iteration step, the final value for Y 1 l B is at least as large 
as the starting value, so the iteratively obtained values 
are monotonically increasing. As F/lb — 1 IS bounded 
from above (not more than 100% of the events can result 
in a click of Bob's detector), the series converges, giving 
the final lower bound on the single-photon yield of the 
signal state. 



V. NEW BOUND ON e^ s) 

We also need to bound the error rate of the single- 
photon events of the signal state from above. In this case, 
Eve wants to introduce as many errors as possible into 
the single-photon events of the signal state while leaving 
the measured QBERs as expected, because this way she 
can gain the maximal amount of information from the 
signal single-photon events. An upper bound on the de- 
coy single-photon events is given by Equation (F7J) if we 

r(d) 



use 1^ lb gi ven by the value ( 29 ) obtained in the iteration 
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for determining Y^ ^ B . Since the errors also have to be as- 
sumed to be under Eve's control, she is free to choose the 
modes into which the errors occur. The highest error rate 
of the signal single-photon events compared to the error 
rate of the decoy single-photon events is obtained if the 
errors are introduced into modes with a large / 



0. Starting ratio. Hence, if we again define K implicitly by 
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K — 1 are erroneous. This gives the 
on the signal single-photon error rate, 
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VI. NUMERICAL SIMULATIONS 



bound 


Width ct 






1 nm 


0.959, 0.194, 0.152, 0.098, 0.088, 0.033, 0.032, 0.014 




2 nm 


0.871, 0.463, 0.140, 0.064, 0.054, 0.028, 0.001 


(32) 


4 nm 


0.690, 0.555, 0.383, 0.222, 0.107, 0.054, 0.050, 0.044, 




0.023, 0.012, 0.004, 0.003, 0.001 




8 nm 


0.511, 0.478, 0.427, 0.364, 0.296, 0.228, 0.167, 0.117, 
0.078, 0.056, 0.047, 0.037, 0.023, 0.015, 0.014, 0.011, 
0.006, 0.003, 0.001 



(s) 

With the new lower bound on Y£ , obtained by Equa- 



TABLE I: A*, for the KTP crystal for different pump widths. 



tion (30 1 in the iteration, and the new upper bound on 
e± given by Equation ( |32| , we can determine a lower 
bound on the achievable key rate for states of the form 
( fl2| with Equation 

In the following simulations, we consider the simplest 
example for the use of a PDC source in a QKD protocol. 
Signal and decoy states are created with different pump 
intensities, and only the photons in the signal mode are 
used for information encoding, while the photons in the 
idler mode are ignored. The PDC output state is modeled 
with a full multimode structure and is given by Equation 
([9]), resulting in the state (12) after tracing over the idler 
mode. The photon number distribution for each spectral 
mode is given by 



P 



(s / d \k,n) = scch 2 rjf /d) tanh 



2n (s/d) 
' u 1 



(33) 



with rl ^ oc Afe V/( s / d ' describing the corresponding 
squeezing parameters. /( s ) and /( d ) are the pump inten- 
sities for signal and decoy state, respectively, and A& in- 
dicates how prominent the fcth mode is. The coefficients 
Afe are properties of the PDC crystal and the pump. 

The photon number distribution for each spectral 
mode, Equation (33 1, is a thermal distribution. Thus the 
single-mode case (Afc = S^i) corresponds to thermal pho- 
ton number distribution. With more contributing modes, 
the distribution is changed from thermal towards a Pois- 
sonian distribution. This is shown in Figure [2] for the 
values of Table [I] and a mean photon number of 0.6. 

Let us first illustrate, by means of a simple example, 
how different mode occupation probabilities arise for sig- 
nal and decoy state. Consider a PDC state with just two 
spectral modes that have Ai = V0.75 and A2 = \/0.25. 
The mode occupation probabilities for a single-photon 
event are then given by 



mi (J) = 



p(l,l)p(2,0) 



m 2 (J) 



p(l,l)p(2,0)+p(l,0)p(2,l) 

tanh 2 7"i 
tanh 2 r\ + tanh 2 r 2 ' 

tanh 2 r 2 
tanh 2 r\ + tanh 2 r 2 



(34) 
(35) 



They inherit the intensity dependence from the squeez- 
ing parameters r\ and r 2 . This intensity dependence is 
shown in Figure [3] along with chosen decoy and signal 
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FIG. 2: (Color online) The photon number distributions for 
different pump widths a. 



intensities such that we end up exactly with the states 
shown in Figure [l] 

Now, we focus on a physically realistic case. Our source 
is a waveguided periodically poled KTP crystal with a 
grating period of A = 68.40/im, length of 5 mm, and 
waveguide width and height both 4 /im. The pump laser 
spectrum is centered at a wavelength of 775nm and the 
signal and idler are frequency degenerate around 1550nm. 
We study four different pump bandwidths ct, which lead 
to different values for Afc [T5]. They are shown in Table [T] 

We first consider the case of ct = 4nm. For given pump 
intensities for signal and decoy state, the mode occupa- 
tion probabilities can be calculated with Equations ( 14 1 



and ( 19 ) for the single-photon and multiphoton state, re- 
spectively. We assume that Eve designs her attack such 
that her presence cannot be detected. This implies that 
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FIG. 3: (Color online) The mode occupation probabilities mi 
and mi for a single-photon event in dependence of the pump 
intensity. 
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the measured gains and error rates for signal and de- 
coy state have the values that are expected from natural 
losses and detection errors. According to [15], they are 
given by 



Q(s /d) = £ FnP ( E 



/d) 



(36) 



s/d) 



(37) 



E (s/d) _ 1 y yp(s 
^ ~ Q(s/d) Z^ e ™ ™ ™ 

n 

with the overall (i.e., convoluted) photon number distri- 

Y„ W Tfo + Pdark) (38) 



butions Pn^ d ^ and 



1 



1 



Cdet^ 



rPdark 



(39) 



In these equations, Pdaxk is the dark count probability 
of Bob's detector, edot is the detection error (i.e., the 
probability that Alice prepares a (1), but Bob detects a 
1 (0)), and Tj n = 1 — (1— rj) n is the probability that at least 
one of n photons arrives at Bob's side and is detected. 
The overall detection probability r\ = 1CP"/ 10 ■ r/ det of 
each photon is determined by the channel attenuation 
a in dB and the detector efficiency 7/det- We use the 
experimental parameters of Ref. [E] in the simulations, 
which are shown in Table [IT] 



Dark count probability 


1.7- 1(T 6 


Detection error 


3.3% 


Detector efficiency 


4.5% 



TABLE II: Characteristics of Bob's detector. 

With the gains and QBER for signal and decoy states, 
Equations (38) and (39), a lower bound on the signal 

and an upper bound on the sig- 



ij 



single-photon yield 

nal single-photon error rate ef J can be calculated as de- 
scribed in Sections |IV| and W\ This allows us to compute 
a lower bound on the achievable key rate according to 
Equation 0. We compare this key rate to the key rate 
for a single-mode source with the same photon number 
distribution. In other words, the secure key rate one 
would falsely expect to be achievable if the multi-mode 
structure of the PDC state is ignored. It is calculated by 
Equation ([T| with the bounds on and given by 
Equations and Q . The corresponding key rates are 
both plotted in Figure [4] against the channel attenuation. 
We find that the key rate drops about 10% when Eve's 
new possible attack is taken into account by adjusting the 
bounds on Y± and accordingly. In both scenarios, 
the mean photon number of the decoy state is 0.1, and 
the mean photon number of the signal state is optimized 
to give the highest key rate. 



multi-mode o=4nm 
single-mode a=4nm 




I 5 10 15 20 25 30 

Attenuation [dB] 

FIG. 4: (Color online) Solid (red) line: Lower bound on the 
secure key rate for the KTP crystal with a pump width of 4 
nm. Dashed (green) line: Lower bound on secure key rate for 
the same photon number distribution, but with all photons in 
the same spectral mode. The inset shows a zoom of the 50- 
55km region. The weak decoy mean photon number is 0.1 in 
both cases, and the signal mean photon number is optimized 
to result in the largest possible rate. 
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FIG. 5: (Color online) Lower bound on the secure key rate 
for different pump width and therefore different mode contri- 
butions. The asymptotic cases are the rates for thermal and 
Poissonian distribution. The inset shows the optimized mean 
photon number of the signal state. The weak decoy mean 
photon number is fixed to 0.1 for all scenarios. 



Figure [5] shows the secure key rate for all different 
pump widths given in Table [I] One can see that the secure 
key rate is higher when more modes contribute to the 
PDC process. This effect is explained by the change in 
the photon number distribution. With more contributing 
modes, the photon number distribution is shifted from 
a thermal distribution to a Poissonian distribution (see 
Figure |2j. The Poissonian distribution is favorable in 
comparison to the thermal distribution, because the ratio 
between single-photon and multiphoton events increases. 
This permits a higher mean photon number for the signal 



8 



state, which in turn increases the achievable key rate and 
distance. The resulting optimal mean photon numbers in 
dependence of the channel attenuation are depicted in the 
inset of Figure [5] 



VII. CONCLUSION 

In summary, we have pointed out the necessity to care- 
fully pay attention to the output states of the utilized 
sources, but likewise demonstrated that the demand for 
perfect indistinguishability of the signal and decoy pho- 
tons, which is hard to implement in practice, can be loos- 
ened for only a small cost in the key rate. 

The analysis was applied to a parametric down conver- 
sion (PDC) source, where the weak decoy state is created 
by pumping the crystal with a lower pump intensity. For 
about ten effectively contributing modes, we observed a 
drop of the key rate to roughly 90% of the correspond- 
ing value in the single-mode case with the same photon 
number distribution. The simulation was performed for 
different numbers of effectively contributing modes, lead- 
ing to the conclusion that the advantageous change in the 
photon number distribution, which occurs if more modes 
contribute has a higher effect on the key rate than the 
aforementioned decrease due to the new attack possibil- 
ity presented to Eve by the multi-mode structure of the 
states. 

This analysis can also be used for a heralded PDC 



source, as long as the heralding detector is frequency in- 
dependent, as the resulting states are also of the form 
of Equation (12 1. For heralding with a frequency de- 



pendent detector, the analysis has to be extended to the 
case where the density matrices for signal and decoy state 
are diagonal in different bases, contrary to our condition 
given by Equation ( 12 1 . 



Another possibility to produce the decoy state is by 
passive decoy generation [2TT1 [H]- ^ n this scheme, the 
complications that arise because of the multi-mode struc- 
ture of the PDC state can be avoided if a frequency inde- 
pendent detector is available for the decoy generation, as 
the spectral properties of n-photon states would then be 
the same for signal and decoy state. This, however, is not 
the case for a frequency dependent detector, because such 
a detector leads to signal and decoy states with different 
spectral properties. Again, the resulting states require 
an analysis for signal and decoy states that are diagonal 
in different bases. 

We believe that this paper is a first step towards al- 
lowing more general signal and decoy states, which will 
significantly simplify the design of QKD sources. 
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